A clinical AI workflow on PHI is HIPAA-compliant AI: it runs a language model on real charts and notes by sending the structure of the case, keeping protected health information inside the hospital, and restoring the identifying values to the finished document locally.
The pressure to use models on clinical text is real, and so is the rulebook standing between the two. HHS guidance recognizes exactly two de-identification paths under HIPAA: Expert Determination, or Safe Harbor, which strips the 18 listed identifiers and demands no actual knowledge that what remains could point back to a patient. The clinical stakes are recognized at the top: the World Health Organization warns that large multi-modal models in health carry cybersecurity risks that could endanger patient information. In healthcare the data problem has a sharper edge: the most useful text a model could touch is the text a hospital is least allowed to move. That single constraint stalls more clinical AI than any model limitation does.
Picture the discharge summary that needs writing. A patient spent nine days on the ward. There are progress notes from four clinicians, a medication list that changed twice, two imaging reports, and a free-text nursing handover that mentions the patient’s name, date of birth, and the room of the patient next door. A model could draft that summary in seconds, and draft it well, because the note is dense, repetitive, and exactly the kind of text language models compress cleanly. Every line of it is protected health information, and the chart is not allowed to leave the hospital. The most useful thing the model could do is the one thing the data won’t permit.
Why stripping the chart and banning the model both fail
Hospitals reach for one of two responses, and a clinical AI workflow on PHI breaks on both.
De-identify the chart first, and you learn quickly that clinical meaning lives in the details you just removed. The temporal sequence of events, the specific dosages, the way one clinician’s note references another’s finding from two days earlier: scrub aggressively enough to feel safe and the model is summarizing a case that no longer hangs together. The draft comes back plausible and subtly wrong, which in a clinical setting is worse than no draft at all.
Lock everything down and refuse the external model, and the clinician keeps writing summaries by hand after a twelve-hour shift. The promised time savings never arrive, and some staff, under pressure, quietly paste chart text into a consumer chatbot to get through the backlog. That last outcome is the one every privacy officer fears most, and a blanket ban tends to produce it rather than prevent it.
The trap is treating the patient identifiers and the clinical reasoning as one inseparable thing. They are separable, and the whole workflow turns on that fact.
HIPAA compliant AI applied to the PHI workflow
The enablement pattern sends the model the structure of the case rather than the chart itself. The nine-day timeline stays a timeline. The medication that was started, escalated, then stopped stays that exact arc. The four clinicians’ notes stay distinct and stay in order. What gets substituted is the identifying layer: the patient’s name and date of birth, the neighbor mentioned in the handover, the record numbers, all replaced before anything reaches the model, while the medical structure underneath is preserved faithfully.
HIPAA compliant AI drafts its discharge summary against that preserved structure. The draft is then reconstructed inside the hospital’s systems, where the real patient identity returns to the document and the summary becomes something a clinician can sign rather than rebuild from scratch. The protected data never left. The drafting ran inside the environment the hospital already trusts, on-prem or in its existing cloud, not in some new place the chart had to travel to.
A Context-Preserving Data Layer for AI, in CUBIG’s case LLM Capsule, does the holding and the rebuilding. It runs on the CUBIG Syntitan platform. Because the substitution preserves structure instead of blanking fields, the model sees a coherent case rather than a chart full of black bars. That distinction is the difference between a draft the clinician edits and signs and a draft the clinician has to write over.
Three moves: Substitute, Execute, Reconstruct
The workflow closes in three moves, and it helps to name them.
- Substitute. Identifying values are swapped for stand-ins before anything leaves the boundary, with the originals held in a protected mapping layer inside the hospital.
- Execute. The model drafts against the substituted case, which still carries the timeline, dosages, and cross-references it needs to reason well.
- Reconstruct. The stand-ins are swapped back for the real values locally, producing an operational artifact the clinician can sign.
The table below shows how this compares to the two habits it replaces.
| Dimension | De-identify the chart | Ban the model | Context-preserving substitution |
|---|---|---|---|
| Clinical detail the model sees | Degraded | None | Preserved |
| PHI leaves the hospital | Partial | No | No |
| Usable draft returned | Partial | No | Yes |
| Clinician still types by hand | Often | Yes | No |
Is your PHI workflow ready for a model?
Run this quick self-check against any clinical task you want a model to take on. If you answer no to more than one, the enablement pattern is likely what is missing.
- Can you identify which fields carry patient identity and which carry clinical meaning, separately?
- Does your current approach preserve the case timeline and dosage arcs when it hands text to a model?
- Does the drafting run inside an environment your security team already trusts?
- Do the real identifiers return to the finished document without a human retyping them?
- Can your privacy officer trace, for any output, that no protected health information crossed the boundary?
Where it fits
This is healthcare’s version of sensitive AI workflow enablement. The same pattern appears in finance, where the protected document is a confidential operational document rather than a chart, and the logic is identical: send the structure, restore the values locally. The underlying mechanics, substitution and local reconstruction, are covered in Substitute, Execute, Reconstruct. All of it runs on the CUBIG Syntitan platform.
Because no protected health information crosses the boundary, the workflow maps cleanly onto HIPAA-style obligations for handling PHI, and it fits the direction clinical AI oversight is already moving: the FDA treats AI in software as a medical device as something to supervise across the total product lifecycle, with its Good Machine Learning Practice principles underneath. The privacy officer and the security team get a concrete basis to sign off. That approval is the by-product. The point was to let the clinician stop typing summaries at midnight.
LLM Capsule is how CUBIG runs HIPAA-compliant AI on clinical workflows without PHI leaving the environment. Patient identifiers are substituted before anything reaches the model and restored locally, so the work runs and the records stay put.
